MAL-2026-5356

Dashboard / Malicious Package / MAL-2026-5356

MAL-2026-5356

Summary: Malicious code in ethereum-kit-9 (npm)

Details: Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling (c960+). postinstall auto-execs, src/index.js harvests ~/.ssh/id_rsa+id_ed25519+Sol/Eth/BTC/Tron/Sui/Aptos wallets+.env+seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 (not rotated). Campaign now uses inflated version (1.25.36) not 1.0.0. Source: amazon-inspector (fca6873d6bb09703d4ceba095e845845ec40ca4274def05870ed6d59b90fdf6a) On `npm install`, the package's postinstall hook loads src/index.js, which after a short delay and a sandbox/CI evasion check enumerates the installer's home and project directories for sensitive files and uploads each one to api.telegram.org using a hardcoded bot token and chat_id. Targeted paths include SSH private keys (~/.ssh/id_rsa, id_ed25519), crypto wallet keystores and data directories for Solana, Ethereum (~/.ethereum/keystore), Bitcoin, Tron, Sui, and Aptos, and project secrets (.env,.env.local, mnemonic.txt, seed.txt, wallet.json, private.key, secrets.json). The payload skips execution when CI/sandbox indicators are present (CI=true, GITHUB_ACTIONS, NODE_ENV=test/development, usernames like runner/sandbox/docker/jenkins, and 12-hex-char container hostnames) to evade analysis. The package name and generic 'Utility library' description with placeholder author impersonate Ethereum tooling to lure developers.

References: https://app.safedep.io/community/malysis/01KTN73YXHEMD7EATFD58FKGEY, https://www.npmjs.com/package/ethereum-kit-9/v/1.25.36